Dinky
CVE-2026-3053
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess OpenAPI endpoint without authentication
-
ExploitBypass interceptor validation in AppConfig
-
ExecutionExecute unauthorized API requests
-
ImpactGain confidentiality and integrity access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | DataLinkDC Dinky versions up to 1.2.5 with OpenAPI endpoint exposed. No authentication required — remote unauthenticated exploitation against default configurations where OpenAPI endpoint is accessible. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to missing authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Dinky versions up to 1.2.5 contain an authentication bypass in the OpenAPI endpoint handler that allows unauthenticated remote attackers to manipulate interceptor configuration. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
Earlier versions of this analysis (1)
A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-287 (Improper Authentication). Affects Dinky. A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Know when Dinky gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity vulnerability in DataLinkDC Dinky versions up to 1.2.5 allows attackers to potentially execute unauthorized actions through the OpenAPI endpoint, with public exploit code already available. Organizations running affected versions face immediate risk of unauthorized access and data compromise until mitigation measures are implemented.
- Network segmentation: Restrict API access to trusted IPs only; 2) WAF deployment: Implement rules to block requests to /dinky-admin OpenAPI endpoints; 3) Disable OpenAPI Endpoint: If operationally feasible, disable the vulnerable endpoint until patch availability; 4) Access controls: Enforce mutual TLS authentication for API calls; 5) Monitoring: Deploy SIEM alerts for suspicious addInterceptors function calls and unauthorized API access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Path traversal in Dinky up to version 1.2.5 allows authenticated remote attackers to access arbitrary files on the syste
Server-side request forgery in Dinky up to version 1.2.5 allows authenticated attackers to make arbitrary HTTP requests
Server-side request forgery in DataLinkDC Dinky up to and including 1.2.5 lets remote attackers make the server issue re
Server-side request forgery in DataLinkDC Dinky through version 1.2.5 lets a remote, unauthenticated attacker control th
Path traversal in the catalogue upload endpoint of DataLinkDC Dinky through 1.2.5 lets an authenticated low-privilege us
Path traversal in DataLinkDC Dinky through 1.2.5 lets a low-privileged authenticated user manipulate the filename argume
Exploit-DB